---
id: 1306
title: "How a Privilege Escalation Led to Unrestricted Admin Account Creation in Shopify"
source_domain: hackerone.com
source_url: "https://www.hackerone.com/blog/how-privilege-escalation-led-unrestricted-admin-account-creation-shopify"
published_at: "2024-12-12 22:50"
tags: ["bug-bounty", "access-control", "privilege-escalation", "authentication", "hackerone", "shopify"]
phying_url: "https://phying.com/item/1306"
lang: en
---

# How a Privilege Escalation Led to Unrestricted Admin Account Creation in Shopify

## Summary

A HackerOne write-up details a Shopify privilege escalation bug enabling unrestricted admin account creation, and how layered access controls can be bypassed.

## Intelligence Metadata

- **Sources:** hackerone.com
- **Published:** 2024-12-12 22:50
- **Original:** https://www.hackerone.com/blog/how-privilege-escalation-led-unrestricted-admin-account-creation-shopify
- **Phying News:** https://phying.com/item/1306